domains / families / devops / phy-k8s-security-audit

phy-k8s-security-audit

separate

Kubernetes manifest security auditor (CIS Kubernetes Benchmark). Scans all YAML/JSON manifests in your repository for privileged containers, hostNetwork/hostPID/hostIPC, dangerous hostPath mounts, missing resource limits/probes, latest image tags, RBAC over-permission (cluster-admin bindings, wildcard verbs), secrets in env vars, missing NetworkPolicy, missing seccomp/AppArmor profiles. Maps findings to CIS Benchmark controls and PSS (Pod Security Standards). Zero dependencies beyond PyYAML. Zero competitors on ClawHub.

When to use

• Scanning YAML/JSON manifests
• Detecting privileged containers
• Checking hostNetwork/hostPID/hostIPC
• Auditing dangerous hostPath mounts
• Checking missing resource limits/probes
• Detecting latest image tags
• Auditing RBAC over-permission
• Checking secrets in env vars

When not to use

• Cluster access
• Runtime security monitoring

Skill page

Source